Privacy Policy — Maly AI

Last updated: September 21, 2026

Data we collect

• Account data: Email, name, and Google/Apple sign-in identifier — used solely for authentication.
• Financial ledger: Accounts, assets, and transactions you enter — stored in your household's Cloud Firestore database.
• Bank messages:
  • Android: If you enable Message tracking in Settings and grant SMS permission, the app receives new messages only (it does not scan your inbox). The app attempts to block OTP and authentication messages on-device. Other messages that look like bank messages may be sent to our server and an AI provider for classification; retries or provider fallback can send the same request to more than one provider. You can turn the feature off or revoke SMS permission anytime.
  • iOS: Apple does not allow apps to read SMS. If you opt in, you configure an Apple Shortcuts automation to forward selected bank messages to the same Cloud Function.
  • Retention: message text may remain in your pending-review queue until you confirm or dismiss it, with a booked transaction as its source record, and in an administrator review/training label when a message needs human review. As closure is processed, our backend removes the raw text copy from the central review mirror and keeps structured metadata and non-readable signatures. Raw SMS is not copied into the classification-feedback record.
• AI chat: We send your question, conversation context, and a structured ledger snapshot (such as balances, account names, categories, selected recent transactions and merchants, commitments, and zakat summaries) to the provider. The snapshot excludes raw SMS and free-form transaction notes. We sync approximately the latest 60 chat messages in your account's Cloud Firestore document so the thread is available across devices.
• Receipt images: If you choose receipt scanning, the image is sent to our server and then to a vision model to extract transaction fields. We do not persist the image file in our server database after the request. While offline, the app may keep the image locally on your device until a retry succeeds or it is removed.
• Voice: A microphone recording is sent to our server and then to Groq Whisper or a Gemini fallback for transcription. We do not persist the audio file in our database after the request; the transcript may become part of chat history. Spoken replies use your device operating system's text-to-speech engine and are not sent to the Maly AI backend for speech generation; the operating system or selected voice provider may apply its own settings and policy.
• Classification feedback and corrections: We may record the model's structured decision and the structured values you accepted, changed, dismissed, or deleted, together with provider/model/prompt/schema versions when available. This record excludes SMS text, account IDs, and free-form notes. User, household, source, template, and sender identities are replaced with server-keyed HMAC signatures.
• Approximate location and IP address: On first launch the app infers your country from your device language and time zone, and calls an IP geolocation service (currently ipapi.co, falling back to ipwho.is and Cloudflare when that lookup fails) once to refine that guess. This is used to pre-select the app language and currency that suit you. We store the country, time zone, region, city, and IP address on your profile, and use them to time notifications and segment campaigns. We never request location permission and never access GPS. You can change the language and currency by hand at any time from your profile.
• Push tokens (FCM): Used to deliver deposit notifications and reminders to your devices.
• Face ID / Touch ID: Biometric authentication happens entirely on your device — we never receive or store biometric data.

How we use your data

Your data is used exclusively to operate the app: syncing your ledger across devices, calculating zakat, and sending notifications. We do not sell your data. Your financial data is never shared with third parties for advertising or marketing; the only advertising-related data is the device advertising identifier described in the Advertising section below.

Advertising

Maly AI is free, and the free app may show ads served by Google AdMob.

• On iOS: the app asks for your permission to track through Apple's App Tracking Transparency prompt. Only if you allow it may your device's advertising identifier (IDFA) be used to personalise the ads you see. If you decline, the ads are non-personalised and every feature of the app works exactly the same.
• On Android: the Google advertising ID may be used to serve ads, subject to your device's ad settings.
• Your financial data is never used for advertising: transactions, balances, bank messages, and zakat figures are never shared with advertisers and are never used to target ads.
• Limiting personalised ads: on iOS, Settings → Privacy & Security → Tracking; on Android, Settings → Google → Ads (reset or delete your advertising ID).
• Ad-free start: new accounts have a 7-day ad-free period.
• Ad-free with Premium: an active Maly Premium subscription, lifetime purchase, or a Premium month granted through the referral programme removes ads for as long as it lasts. Ads return when it ends.
• Google's use of this data is governed by Google's Privacy Policy and the How Google uses information from sites or apps that use our services page.

Purchases and subscriptions

Maly Premium is optional. All payments are processed by Apple's App Store or Google's Google Play. We never receive or store your card or bank details.

• RevenueCat: we use RevenueCat to validate purchase receipts and track subscription state. It receives the store's purchase receipt, an app user id equal to your Maly AI account id, and the subscription facts that come with the receipt (product, expiry, auto-renew status, sandbox or production). It never receives your name, email, card details, or anything from your financial ledger or bank messages.
• What we store: your entitlement state (active/expired, product, expiry, store) on your profile, and a purchase-event log for support and auditing that is deleted automatically after about 400 days.
• Cancellation and refunds happen in your store's settings and follow Apple's or Google's refund policy. See our Terms of Use.
• Payment is also governed by the store's own privacy policy: Apple and Google.

AI processing and providers

Classification, chat, receipt, and voice features use a server-managed provider chain: normally Groq first, with Google AI Studio and/or Gemini on Vertex AI as configured fallbacks. A provider receives the content needed for the feature: bank-message text for classification, a receipt image for vision, audio for transcription, or your question and ledger context for chat. API keys never ship in the app.

• Groq processing is governed by the Groq Privacy Policy.
• Under Google AI Studio's free-tier terms, prompts and responses may be used to improve Google products and may be reviewed by humans. Vertex AI is governed by Google Cloud data-governance controls. See also the Google Privacy Policy and Gemini API terms.
• We currently do not train or fine-tune our own foundation model. User feedback is not automatic ground truth: it is stored as untrusted and pending adjudication, and is not eligible as a correct label until independently reviewed by a human.

Retention

• Your profile, financial ledger, and chat history remain while the account or household exists. You can clear the current chat from the chat screen.
• A pending bank message remains until it is reviewed. Source text stored with a transaction remains until that transaction or its household is deleted. A copy in an administrator review/training label may remain until the household is deleted or the operational or legal need ends.
• Unadjudicated classification-feedback rows have a 180-day expiry timestamp, as do central review mirrors after their raw text has been redacted. Firestore TTL deletion can occur after the timestamp rather than immediately. We also purge linked rows when an account or its household is deleted.
• Limited security/operational logs and backups may remain for the relevant Google Cloud or provider retention cycle and are then deleted under that provider's policy.

Data deletion

You can delete your account from within the app (Profile → Delete Account), or request help at the email below. We remove the user profile, chat, devices, usage, ratings, and AI feedback/review/training/provenance rows attributed to the user and to any household deleted with the account. If other members remain in a shared household, ownership transfers to them and the shared ledger and household-level review evidence remain; one member leaving does not erase the remaining members' shared data.

Contact

For privacy inquiries: mostafaradwan1001@gmail.com